---
id: "CVE-2026-77474"
kind: "vulnerability"
aliases: ["CVE-2026-77474"]
title: "dcg: crafted shell substitutions hang safety hook, letting destructive commands through"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-coding-agents", "ai-tooling", "claude-code", "dcg", "shell"]
not_affected_if: ["dcg-not-installed", "version-0.6.6-or-later"]
published_at: "2026-10-16T17:17:50+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:36:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77474", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# dcg: crafted shell substitutions hang safety hook, letting destructive commands through

destructive_command_guard (dcg) is a safety tool that blocks destructive shell commands before AI coding agents run them. Before 0.6.6, nested or unclosed $( and $(( substitutions trigger exponential rescanning, so the PreToolUse hook hangs and fails open, letting the destructive command run.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `dcg --version` and confirm it reports a version earlier than `0.6.6`.
- Check whether dcg is wired into a PreToolUse hook for your coding agent (unknown how to find this from the sources).

## Fix

- Upgrade destructive_command_guard (dcg) to `0.6.6` or later.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77474

## From the sources

destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_